Cart
[Home] [By Thread] [By Date] [Recent Entries]
> >Any chance of some details of just what it is in the internal subset > >which triggers this behaviour, and how? > > You can easily construct a few entities that expand to a huge result. > Depending on how your parser returns things, this may use lots of > memory or merely use up lots of cpu time. There is an example at > > http://www.cogsci.ed.ac.uk/~richard/billion-laughs.xml > > I don't recommend loading this file into a browser. This is exactly the attack reported to us. So I don't need to post it anymore. For Expat and MSXML this is a CPU hog only. However, you can turn it into a memory hog on these parsers by using an external subset and PE entities/references instead of GE references/entities (except for the last one). Karl
|
